For AI platform teams
You own the AI platform.
Not every call on it.
Have the AI platform team set the rules once, and let every agent on the platform ask a person before it moves money or does something that cannot be undone. Deliverd is the part of the platform that decides who may act, puts the question in front of the person who owns it, and keeps the answer, so your team runs the platform instead of answering for every agent on it. Your model gateway, your evaluation tools and your identity provider stay where they are.
No card required · Approvals on every plan · Secure by default
What you get
What Deliverd changes for AI platform teams.
One set of rules for every agent on the platform
The platform team writes the rules once, as reviewable policy: what is settled automatically, what goes to a person, and who that person is. Every agent, in every framework, asks the same way.
How: A check before the agent acts ↓A person decides when money moves or nothing can be undone
The question reaches the person who owns the decision in Slack, Teams, email or on a phone, with what the agent wants to do and why. The platform team is not the help desk for every approval.
How: Your AI asks before it acts ↓The record your security and risk teams ask for
Which agent asked, under which rule, who answered and what ran, in one exportable timeline, next to the traces and evaluation results you already keep.
How: One pack for the auditor ↓The situation
What this looks like today
Every team's agent asks differently, or not at all
One team's agent pauses in LangGraph, another's in the Claude Agent SDK, a third never pauses. The platform team ends up writing the same approval step, the same routing and the same log for each of them.
The gateway knows the model call, not the decision
A model gateway sees tokens, keys and spend. It does not know that this tool call refunds a customer, who is allowed to agree to that, or what they were shown when they did.
Agents nobody registered
Teams buy and build agents faster than anyone can list them. When security asks which agents can act on production or on customer money, the answer is a spreadsheet and a guess.
The remit
What an AI platform team owns, and where Deliverd fits
The six things an AI platform team is usually expected to own, and an honest answer for each. Deliverd is the governance part; it is not a model gateway, an evaluation platform or a cost controller.
Policy
Deliverd does this
Rules as reviewable policy, templates, a simulator, ethics rules and a stop button for the whole estate. Every agent asks the same way, and an action nobody has written a rule for goes to a person.
Tool registry
Deliverd does part of this
MCP servers and HTTP APIs put behind a Deliverd gateway are listed, with their credential sealed and the calls that change something checked. Tools that are not behind a gateway are not in the list.
Agent identity
Deliverd does part of this
Each agent has its own name and keys, scoped and revocable, and agents can sign in with Microsoft Entra Agent ID. Your identity provider stays the source of truth.
Evaluations
Deliverd does part of this
Results from Langfuse, LangSmith, Braintrust and Weave can be pulled in as evidence for a release decision. Deliverd does not run evaluations.
Model access
Works beside the tool you use
Keep your model gateway. Deliverd checks the tool calls an agent makes, not the model requests, so it works whichever gateway or provider sits in front of the model.
Cost control
Works beside the tool you use
Budgets and spend limits stay in your model gateway or cloud account. Deliverd does not meter tokens.
How it works
Deliverd for AI platform teams
Everything below ships today. Where something needs a paid plan, it says so.
Your AI asks before it acts
An agent that needs a decision puts it to a named person and waits: what it wants to do, why, how risky it is, and what to read first. They approve, approve with changes, reject with a reason, or ask the agent a question — on the page, from an email link, in Slack or Teams, or from a push notification on a phone — and a colleague can cover their approvals while they are away. It can also ask for a review, or for information it is missing, the same way.
A check before the agent acts
Before a consequential action — a payment, a deployment, a message to a customer — the agent declares what it is about to do and waits for the answer. A named person decides, or your organisation's rules settle the routine cases and send the rest to a person; with no rules, every one goes to a person. Afterwards the agent records what ran, and the record is checked against what was allowed.
On every plan; policy rules included in Business Starter, Business and Enterprise
Tool calls checked on the way through
Put Deliverd in front of an MCP server or an HTTP API under Organisation → Integrations & webhooks. The server's credential is sealed there and the agent gets only the gateway's address and its own key, so a call that changes something reaches the server after a rule or a person has said yes, and a refusal never reaches it at all. An agent that still holds the server's own credential can go around it, so keep that key in the gateway alone.
Each agent under its own name
Register each agent on Agents → Agents and it acts under its own name, which is what the audit trail shows for every request it makes. You decide what it may ask people for and where it may publish, and its keys can be rotated or revoked without touching anyone else's.
Included in Team, Business Starter, Business and Enterprise
One pack for the auditor
Every step of a piece of work — who was asked, what they said, what was decided and when — exported as a single timeline in JSON, CSV or PDF. It carries a digest and the head of the hash-chained audit trail, signed with a published key, so anyone can check a copy offline, and the export itself is on the record.
A second thought, where it matters
Your organisation writes rules for requests that touch someone's job, money, health or privacy, or that cannot be undone. When one matches, whoever decides sees the concern first and has to say why it is right to go ahead; a rule can also ask more people to agree, or refuse. Ethics rules only add oversight — none of them can approve anything — and they are on every plan.
Governance recorded as the work happens
Compliance Mode adds a register of the AI systems you use and, on governed work, the owners and the risk and data classification. That profile decides the controls: evidence or a person's approval meets each one, and an exception, with an owner and an expiry, shows as waived rather than met. The whole record exports as one evidence pack. It records how the work was governed — it does not certify compliance with any law or standard.
Included in Business and Enterprise
The work keeps its objective
A task holds what the work is for apart from the conversation doing it, with a short state — where it stands, the next action, what is in the way — that any agent reads when it resumes. Side tasks take a bug or a piece of research out of the main thread and come back with a result. Switch tool or model and the next one picks up where things stand instead of starting over, and only a person changes the objective.
Included in Team, Business Starter, Business and Enterprise
Questions
AI platform teams and Deliverd.
Do we have to replace our model gateway?
No. A model gateway decides which model a request goes to and what it costs. Deliverd decides whether the action the model proposed should happen and who agrees to it. They sit at different points: the gateway in front of the model, Deliverd in front of the tool call. The developer docs have recipes for agents built on the AI SDK, for MCP servers and for APIs behind Azure API Management.
Will a gate catch an agent that never asks?
A gate is advisory when the agent calls it directly: the agent reports what it intends to do and performs the action itself, so it catches only an agent that asks. Put an MCP server or an HTTP API behind a Deliverd gateway and keep its credential there, and a call that changes something does not reach it without a yes. Where the code that acts is yours, it can check the signed decision token before it does anything.
Can an agent approve its own request, or write its own rules?
No. The requester is removed from the approvers and an agent may not be an approver of anything. Writing a policy rule is how authority is granted, so an agent is refused at the service rather than hidden in the interface.
Can a destructive action get a second look first?
Yes. The starter ethics rule “Things that cannot be undone” flags requests that mention deleting everything, wiping, purging or dropping a table, and asks whoever decides whether there is a way back if it turns out to be wrong. It arrives switched off; once on, a flagged approval needs a reason before it goes ahead, and the concern goes into the evidence pack.
Which agents does it work with?
Anything that can make an HTTP request: the MCP server, the REST API, the CLI, and SDKs for TypeScript, Python, Rust and .NET, with adapters for the Claude Agent SDK, the AI SDK, the OpenAI Agents SDK and LangGraph. Coding agents get hooks for Claude Code, Codex, Cursor and GitHub Copilot, and a GitHub Action.
Run the platform. Let the right person decide.
One set of rules for every agent, a person asked when money moves or nothing can be undone, and a record of who allowed what. Bought, not built.